1 /* $NetBSD: exec_subr.c,v 1.91 2024/12/06 16:48:13 riastradh Exp $ */
2
3 /*
4 * Copyright (c) 1993, 1994, 1996 Christopher G. Demetriou
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. All advertising materials mentioning features or use of this software
16 * must display the following acknowledgement:
17 * This product includes software developed by Christopher G. Demetriou.
18 * 4. The name of the author may not be used to endorse or promote products
19 * derived from this software without specific prior written permission
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 #include <sys/cdefs.h>
34 __KERNEL_RCSID(0, "$NetBSD: exec_subr.c,v 1.91 2024/12/06 16:48:13 riastradh Exp $");
35
36 #include "opt_pax.h"
37
38 #include <sys/param.h>
39 #include <sys/types.h>
40
41 #include <sys/device.h>
42 #include <sys/exec.h>
43 #include <sys/filedesc.h>
44 #include <sys/kmem.h>
45 #include <sys/mman.h>
46 #include <sys/pax.h>
47 #include <sys/proc.h>
48 #include <sys/resourcevar.h>
49 #include <sys/sdt.h>
50 #include <sys/systm.h>
51 #include <sys/vnode.h>
52
53 #include <uvm/uvm_extern.h>
54
55 #define VMCMD_EVCNT_DECL(name) \
56 static struct evcnt vmcmd_ev_##name = \
57 EVCNT_INITIALIZER(EVCNT_TYPE_MISC, NULL, "vmcmd", #name); \
58 EVCNT_ATTACH_STATIC(vmcmd_ev_##name)
59
60 #define VMCMD_EVCNT_INCR(name) \
61 vmcmd_ev_##name.ev_count++
62
63 VMCMD_EVCNT_DECL(calls);
64 VMCMD_EVCNT_DECL(extends);
65 VMCMD_EVCNT_DECL(kills);
66
67 #ifdef DEBUG_STACK
68 #define DPRINTF(a) uprintf a
69 #else
70 #define DPRINTF(a)
71 #endif
72
73 unsigned int user_stack_guard_size = 1024 * 1024;
74 unsigned int user_thread_stack_guard_size = 64 * 1024;
75
76 /*
77 * new_vmcmd():
78 * create a new vmcmd structure and fill in its fields based
79 * on function call arguments. make sure objects ref'd by
80 * the vmcmd are 'held'.
81 */
82
83 void
new_vmcmd(struct exec_vmcmd_set * evsp,int (* proc)(struct lwp * l,struct exec_vmcmd *),vsize_t len,vaddr_t addr,struct vnode * vp,u_long offset,u_int prot,int flags)84 new_vmcmd(struct exec_vmcmd_set *evsp,
85 int (*proc)(struct lwp * l, struct exec_vmcmd *),
86 vsize_t len, vaddr_t addr, struct vnode *vp, u_long offset,
87 u_int prot, int flags)
88 {
89 struct exec_vmcmd *vcp;
90
91 VMCMD_EVCNT_INCR(calls);
92 KASSERT(proc != vmcmd_map_pagedvn || (vp->v_iflag & VI_TEXT));
93 KASSERT(vp == NULL || vrefcnt(vp) > 0);
94
95 if (evsp->evs_used >= evsp->evs_cnt)
96 vmcmdset_extend(evsp);
97 vcp = &evsp->evs_cmds[evsp->evs_used++];
98 vcp->ev_proc = proc;
99 vcp->ev_len = len;
100 vcp->ev_addr = addr;
101 if ((vcp->ev_vp = vp) != NULL)
102 vref(vp);
103 vcp->ev_offset = offset;
104 vcp->ev_prot = prot;
105 vcp->ev_flags = flags;
106 }
107
108 void
vmcmdset_extend(struct exec_vmcmd_set * evsp)109 vmcmdset_extend(struct exec_vmcmd_set *evsp)
110 {
111 struct exec_vmcmd *nvcp;
112 u_int ocnt;
113
114 #ifdef DIAGNOSTIC
115 if (evsp->evs_used < evsp->evs_cnt)
116 panic("vmcmdset_extend: not necessary");
117 #endif
118
119 /* figure out number of entries in new set */
120 if ((ocnt = evsp->evs_cnt) != 0) {
121 evsp->evs_cnt += ocnt;
122 VMCMD_EVCNT_INCR(extends);
123 } else
124 evsp->evs_cnt = EXEC_DEFAULT_VMCMD_SETSIZE;
125
126 /* allocate it */
127 nvcp = kmem_alloc(evsp->evs_cnt * sizeof(struct exec_vmcmd), KM_SLEEP);
128
129 /* free the old struct, if there was one, and record the new one */
130 if (ocnt) {
131 memcpy(nvcp, evsp->evs_cmds,
132 (ocnt * sizeof(struct exec_vmcmd)));
133 kmem_free(evsp->evs_cmds, ocnt * sizeof(struct exec_vmcmd));
134 }
135 evsp->evs_cmds = nvcp;
136 }
137
138 void
kill_vmcmds(struct exec_vmcmd_set * evsp)139 kill_vmcmds(struct exec_vmcmd_set *evsp)
140 {
141 struct exec_vmcmd *vcp;
142 u_int i;
143
144 VMCMD_EVCNT_INCR(kills);
145
146 if (evsp->evs_cnt == 0)
147 return;
148
149 for (i = 0; i < evsp->evs_used; i++) {
150 vcp = &evsp->evs_cmds[i];
151 if (vcp->ev_vp != NULL)
152 vrele(vcp->ev_vp);
153 }
154 kmem_free(evsp->evs_cmds, evsp->evs_cnt * sizeof(struct exec_vmcmd));
155 evsp->evs_used = evsp->evs_cnt = 0;
156 }
157
158 /*
159 * vmcmd_map_pagedvn():
160 * handle vmcmd which specifies that a vnode should be mmap'd.
161 * appropriate for handling demand-paged text and data segments.
162 */
163
164 static int
vmcmd_get_prot(struct lwp * l,const struct exec_vmcmd * cmd,vm_prot_t * prot,vm_prot_t * maxprot)165 vmcmd_get_prot(struct lwp *l, const struct exec_vmcmd *cmd, vm_prot_t *prot,
166 vm_prot_t *maxprot)
167 {
168 vm_prot_t extraprot = PROT_MPROTECT_EXTRACT(cmd->ev_prot);
169
170 *prot = cmd->ev_prot & UVM_PROT_ALL;
171 *maxprot = PAX_MPROTECT_MAXPROTECT(l, *prot, extraprot, UVM_PROT_ALL);
172
173 if ((*prot & *maxprot) != *prot)
174 return SET_ERROR(EACCES);
175 return PAX_MPROTECT_VALIDATE(l, *prot);
176 }
177
178 int
vmcmd_map_pagedvn(struct lwp * l,struct exec_vmcmd * cmd)179 vmcmd_map_pagedvn(struct lwp *l, struct exec_vmcmd *cmd)
180 {
181 struct uvm_object *uobj;
182 struct vnode *vp = cmd->ev_vp;
183 struct proc *p = l->l_proc;
184 int error;
185 vm_prot_t prot, maxprot;
186
187 KASSERT(vp->v_iflag & VI_TEXT);
188
189 /*
190 * map the vnode in using uvm_map.
191 */
192
193 if (cmd->ev_len == 0)
194 return 0;
195 if (cmd->ev_offset & PAGE_MASK)
196 return SET_ERROR(EINVAL);
197 if (cmd->ev_addr & PAGE_MASK)
198 return SET_ERROR(EINVAL);
199 if (cmd->ev_len & PAGE_MASK)
200 return SET_ERROR(EINVAL);
201
202 if ((error = vmcmd_get_prot(l, cmd, &prot, &maxprot)) != 0)
203 return error;
204
205 /*
206 * check the file system's opinion about mmapping the file
207 */
208
209 error = VOP_MMAP(vp, prot, l->l_cred);
210 if (error)
211 return error;
212
213 if ((vp->v_vflag & VV_MAPPED) == 0) {
214 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
215 vp->v_vflag |= VV_MAPPED;
216 VOP_UNLOCK(vp);
217 }
218
219 /*
220 * do the map, reference the object for this map entry
221 */
222 uobj = &vp->v_uobj;
223 vref(vp);
224
225 error = uvm_map(&p->p_vmspace->vm_map, &cmd->ev_addr, cmd->ev_len,
226 uobj, cmd->ev_offset, 0,
227 UVM_MAPFLAG(prot, maxprot, UVM_INH_COPY,
228 UVM_ADV_NORMAL, UVM_FLAG_COPYONW|UVM_FLAG_FIXED));
229 if (error) {
230 uobj->pgops->pgo_detach(uobj);
231 }
232 return error;
233 }
234
235 /*
236 * vmcmd_map_readvn():
237 * handle vmcmd which specifies that a vnode should be read from.
238 * appropriate for non-demand-paged text/data segments, i.e. impure
239 * objects (a la OMAGIC and NMAGIC).
240 */
241 int
vmcmd_map_readvn(struct lwp * l,struct exec_vmcmd * cmd)242 vmcmd_map_readvn(struct lwp *l, struct exec_vmcmd *cmd)
243 {
244 struct proc *p = l->l_proc;
245 int error;
246 long diff;
247
248 if (cmd->ev_len == 0)
249 return 0;
250
251 diff = cmd->ev_addr - trunc_page(cmd->ev_addr);
252 cmd->ev_addr -= diff; /* required by uvm_map */
253 cmd->ev_offset -= diff;
254 cmd->ev_len += diff;
255
256 error = uvm_map(&p->p_vmspace->vm_map, &cmd->ev_addr,
257 round_page(cmd->ev_len), NULL, UVM_UNKNOWN_OFFSET, 0,
258 UVM_MAPFLAG(UVM_PROT_ALL, UVM_PROT_ALL, UVM_INH_COPY,
259 UVM_ADV_NORMAL,
260 UVM_FLAG_FIXED|UVM_FLAG_OVERLAY|UVM_FLAG_COPYONW));
261
262 if (error)
263 return error;
264
265 return vmcmd_readvn(l, cmd);
266 }
267
268 int
vmcmd_readvn(struct lwp * l,struct exec_vmcmd * cmd)269 vmcmd_readvn(struct lwp *l, struct exec_vmcmd *cmd)
270 {
271 struct proc *p = l->l_proc;
272 int error;
273 vm_prot_t prot, maxprot;
274
275 error = vn_rdwr(UIO_READ, cmd->ev_vp, (void *)cmd->ev_addr,
276 cmd->ev_len, cmd->ev_offset, UIO_USERSPACE, IO_UNIT,
277 l->l_cred, NULL, l);
278 if (error)
279 return error;
280
281 if ((error = vmcmd_get_prot(l, cmd, &prot, &maxprot)) != 0)
282 return error;
283
284 #ifdef PMAP_NEED_PROCWR
285 /*
286 * we had to write the process, make sure the pages are synched
287 * with the instruction cache.
288 */
289 if (prot & VM_PROT_EXECUTE)
290 pmap_procwr(p, cmd->ev_addr, cmd->ev_len);
291 #endif
292
293 /*
294 * we had to map in the area at PROT_ALL so that vn_rdwr()
295 * could write to it. however, the caller seems to want
296 * it mapped read-only, so now we are going to have to call
297 * uvm_map_protect() to fix up the protection. ICK.
298 */
299 if (maxprot != VM_PROT_ALL) {
300 error = uvm_map_protect(&p->p_vmspace->vm_map,
301 trunc_page(cmd->ev_addr),
302 round_page(cmd->ev_addr + cmd->ev_len),
303 maxprot, true);
304 if (error)
305 return error;
306 }
307
308 if (prot != maxprot) {
309 error = uvm_map_protect(&p->p_vmspace->vm_map,
310 trunc_page(cmd->ev_addr),
311 round_page(cmd->ev_addr + cmd->ev_len),
312 prot, false);
313 if (error)
314 return error;
315 }
316
317 return 0;
318 }
319
320 /*
321 * vmcmd_map_zero():
322 * handle vmcmd which specifies a zero-filled address space region. The
323 * address range must be first allocated, then protected appropriately.
324 */
325
326 int
vmcmd_map_zero(struct lwp * l,struct exec_vmcmd * cmd)327 vmcmd_map_zero(struct lwp *l, struct exec_vmcmd *cmd)
328 {
329 struct proc *p = l->l_proc;
330 int error;
331 long diff;
332 vm_prot_t prot, maxprot;
333
334 diff = cmd->ev_addr - trunc_page(cmd->ev_addr);
335 cmd->ev_addr -= diff; /* required by uvm_map */
336 cmd->ev_len += diff;
337
338 if ((error = vmcmd_get_prot(l, cmd, &prot, &maxprot)) != 0)
339 return error;
340
341 error = uvm_map(&p->p_vmspace->vm_map, &cmd->ev_addr,
342 round_page(cmd->ev_len), NULL, UVM_UNKNOWN_OFFSET, 0,
343 UVM_MAPFLAG(prot, maxprot, UVM_INH_COPY,
344 UVM_ADV_NORMAL,
345 UVM_FLAG_FIXED|UVM_FLAG_COPYONW));
346 if (cmd->ev_flags & VMCMD_STACK)
347 curproc->p_vmspace->vm_issize += atop(round_page(cmd->ev_len));
348 return error;
349 }
350
351 /*
352 * exec_read():
353 *
354 * Read from vnode into buffer at offset.
355 */
356 int
exec_read(struct lwp * l,struct vnode * vp,u_long off,void * bf,size_t size,int ioflg)357 exec_read(struct lwp *l, struct vnode *vp, u_long off, void *bf, size_t size,
358 int ioflg)
359 {
360 int error;
361 size_t resid;
362
363 KASSERT((ioflg & IO_NODELOCKED) == 0 || VOP_ISLOCKED(vp) != LK_NONE);
364
365 if ((error = vn_rdwr(UIO_READ, vp, bf, size, off, UIO_SYSSPACE,
366 ioflg, l->l_cred, &resid, NULL)) != 0)
367 return error;
368 /*
369 * See if we got all of it
370 */
371 if (resid != 0)
372 return SET_ERROR(ENOEXEC);
373 return 0;
374 }
375
376 /*
377 * exec_setup_stack(): Set up the stack segment for an elf
378 * executable.
379 *
380 * Note that the ep_ssize parameter must be set to be the current stack
381 * limit; this is adjusted in the body of execve() to yield the
382 * appropriate stack segment usage once the argument length is
383 * calculated.
384 *
385 * This function returns an int for uniformity with other (future) formats'
386 * stack setup functions. They might have errors to return.
387 */
388
389 int
exec_setup_stack(struct lwp * l,struct exec_package * epp)390 exec_setup_stack(struct lwp *l, struct exec_package *epp)
391 {
392 vsize_t max_stack_size;
393 vaddr_t access_linear_min;
394 vsize_t access_size;
395 vaddr_t noaccess_linear_min;
396 vsize_t noaccess_size;
397
398 #ifndef USRSTACK32
399 #define USRSTACK32 (0x00000000ffffffffL&~PGOFSET)
400 #endif
401 #ifndef MAXSSIZ32
402 #define MAXSSIZ32 (MAXSSIZ >> 2)
403 #endif
404
405 if (epp->ep_flags & EXEC_32) {
406 epp->ep_minsaddr = USRSTACK32;
407 max_stack_size = MAXSSIZ32;
408 } else {
409 epp->ep_minsaddr = USRSTACK;
410 max_stack_size = MAXSSIZ;
411 }
412
413 DPRINTF(("ep_minsaddr=%#jx max_stack_size=%#jx\n",
414 (uintmax_t)epp->ep_minsaddr, (uintmax_t)max_stack_size));
415
416 pax_aslr_stack(epp, &max_stack_size);
417
418 DPRINTF(("[RLIMIT_STACK].lim_cur=%#jx max_stack_size=%#jx\n",
419 (uintmax_t)l->l_proc->p_rlimit[RLIMIT_STACK].rlim_cur,
420 (uintmax_t)max_stack_size));
421 epp->ep_ssize = MIN(l->l_proc->p_rlimit[RLIMIT_STACK].rlim_cur,
422 max_stack_size);
423
424 l->l_proc->p_stackbase = epp->ep_minsaddr;
425
426 epp->ep_maxsaddr = (vaddr_t)STACK_GROW(epp->ep_minsaddr,
427 max_stack_size);
428
429 DPRINTF(("ep_ssize=%#jx ep_minsaddr=%#jx ep_maxsaddr=%#jx\n",
430 (uintmax_t)epp->ep_ssize, (uintmax_t)epp->ep_minsaddr,
431 (uintmax_t)epp->ep_maxsaddr));
432
433 /*
434 * set up commands for stack. note that this takes *two*, one to
435 * map the part of the stack which we can access, and one to map
436 * the part which we can't.
437 *
438 * arguably, it could be made into one, but that would require the
439 * addition of another mapping proc, which is unnecessary
440 */
441 access_size = epp->ep_ssize;
442 access_linear_min = (vaddr_t)STACK_ALLOC(epp->ep_minsaddr, access_size);
443 noaccess_size = max_stack_size - access_size;
444 noaccess_linear_min = (vaddr_t)STACK_ALLOC(STACK_GROW(epp->ep_minsaddr,
445 access_size), noaccess_size);
446
447 DPRINTF(("access_size=%#jx, access_linear_min=%#jx, "
448 "noaccess_size=%#jx, noaccess_linear_min=%#jx\n",
449 (uintmax_t)access_size, (uintmax_t)access_linear_min,
450 (uintmax_t)noaccess_size, (uintmax_t)noaccess_linear_min));
451
452 if (user_stack_guard_size > 0) {
453 #ifdef __MACHINE_STACK_GROWS_UP
454 vsize_t guard_size = MIN(VM_MAXUSER_ADDRESS - epp->ep_maxsaddr, user_stack_guard_size);
455 if (guard_size > 0)
456 NEW_VMCMD(&epp->ep_vmcmds, vmcmd_map_zero, guard_size,
457 epp->ep_maxsaddr, NULL, 0, VM_PROT_NONE);
458 #else
459 NEW_VMCMD(&epp->ep_vmcmds, vmcmd_map_zero, user_stack_guard_size,
460 epp->ep_maxsaddr - user_stack_guard_size, NULL, 0, VM_PROT_NONE);
461 #endif
462 }
463 if (noaccess_size > 0 && noaccess_size <= MAXSSIZ) {
464 NEW_VMCMD2(&epp->ep_vmcmds, vmcmd_map_zero, noaccess_size,
465 noaccess_linear_min, NULL, 0,
466 VM_PROT_NONE | PROT_MPROTECT(VM_PROT_READ | VM_PROT_WRITE),
467 VMCMD_STACK);
468 }
469 KASSERT(access_size > 0);
470 KASSERT(access_size <= MAXSSIZ);
471 NEW_VMCMD2(&epp->ep_vmcmds, vmcmd_map_zero, access_size,
472 access_linear_min, NULL, 0, VM_PROT_READ | VM_PROT_WRITE,
473 VMCMD_STACK);
474
475 return 0;
476 }
477